Alpine Linux and other musl systems: one very long password opens key-only SSH accounts. Update OpenSSH and restart sshd

OpenSSH shipped 10.6p2 on November 5 to close a login bypass that researchers named SSHole. On Linux systems built on musl libc without PAM, Alpine being the best known, an attacker who can reach the SSH port can log in to an account that has no password at all by sending a password between 257 and 1,024 characters long.

Alpine says it takes one connection and works every time. Fixed packages are out for every Alpine release back to 3.16, but upgrading the package does not replace the sshd that is already running.

On Alpine, a key-only account can accept a 300-character password. Run apk upgrade, then restart sshd, or the old daemon keeps listening.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

One long password opens key-only SSH accounts

CVE-2026-123158 (CVSS 8.1) affects sshd before 10.6p2 on Linux when musl libc is used without PAM. When sshd checks a password for an account whose stored field is too short to hold a salt, it borrows another account’s salt. musl’s crypt() returns * as an error when the input is over 256 bytes, and * is exactly what a key-only account stores. The two match, and the login succeeds.

OpenSSH developer Damien Miller called the root cause outside sshd but exploitable through it, and said the team released fast because AI tools have been rediscovering bugs within hours. Researcher Özgün Kültekin of Wakefield reported it.

• Exposed: Alpine’s openssh-server (built without PAM), or openssh-server-pam with UsePAM no; PasswordAuthentication yes; an account with * as its password field; and at least one other local account with a $5$ or $6$ hash.
• Alpine fixed openssh in every branch from 3.16 to edge (3.24: 10.3_p1-r2; 3.23: 10.2_p1-r1; 3.22: 10.0_p1-r11; 3.21: 9.9_p2-r1). Point releases 3.21.10, 3.22.8, 3.23.8 and 3.24.4 carry the fix.
• SecurityWeek lists OpenWrt, Buildroot and Yocto builds among other musl-based platforms where key-only accounts like root can be reached.

Alpine, OpenWrt and other musl systems with password login on

Key-only accounts are where admins put their trust: root on Alpine ships as root:*, and the official tiny-cloud images ship an alpine user with * and passwordless doas. One console password set later is enough to make those images exploitable, and a shell as alpine becomes root through doas.

Alpine runs a lot of small VMs, appliances and jump boxes, and some containers run sshd too. Researchers quoted by SecurityWeek expected SSH brute-forcers to add the one-connection check by the weekend, because each try costs a single connection.

Update openssh, then restart sshd

• On every Alpine host that runs sshd: apk upgrade -U -a, then rc-service sshd restart.
• If you cannot update yet, set PasswordAuthentication no (Alpine’s advisory gives a drop-in file and a sed line), check with sshd -t, restart sshd and confirm sshd -T | grep -i passwordauthentication prints no.
• Rebuild golden images and container images that bundle sshd from fixed point releases (3.21.10, 3.22.8, 3.23.8, 3.24.4 or later).
• Ask appliance and router vendors whose firmware uses musl and OpenSSH without PAM for a fixed build.

Details

• CVE-2026-123158 (SSHole): sshd before 10.6p2 on Linux with musl libc and PAM disabled; passwords of 257 to 1,024 bytes match accounts whose password field is *. CVSS 8.1.
• Fixed: OpenSSH 10.6p2 (November 5, 2026). Alpine openssh: edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1, 3.20 9.7_p1-r6, 3.19 9.6_p1-r3, 3.18 9.3_p2-r4, 3.17 9.1_p1-r7, 3.16 9.0_p1-r6.
• Not affected: PasswordAuthentication no, openssh-server-pam with UsePAM yes, locked accounts (!), and cloud-init images that write PasswordAuthentication no.
• Exploitation: none reported as of Alpine’s November 5 advisory; details and lab repos are public.

Hunt / verify

• Search /var/log/messages for Accepted password for on accounts that have no password (root, alpine, key-only users).
• Review doas use, new users, new files and new authorized_keys entries on exposed hosts.
• List hosts where sshd -T shows passwordauthentication yes and the openssh package is older than the fixed version above.

Source: Alpine advisory; OpenSSH 10.6p2 release notes

Sources

• Alpine Linux: Security advisory: openssh-server password authentication bypass (November 5, 2026)
• OpenSSH: Release notes (10.6p2)
• SecurityWeek: OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass
• CVE.org: CVE-2026-123158
• NVD: CVE-2026-123158

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].